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A secret sharing scheme is a cryptographic protocol to distribute a secret state in an encoded 
form among a group of players such that only authorized subsets of the players can reconstruct 
the secret. Classically, efficient secret sharing schemes have been shown to be induced by matroids. 
Furthermore, access structures of such schemes can be characterized by an excluded minor relation. 
No such relations are known for quantum secret sharing schemes. In this paper we take the first steps 
toward a matroidal characterization of quantum secret sharing schemes. In addition to providing a 
new perspective on quantum secret sharing schemes, this characterization has important benefits. 
While previous work has shown how to construct quantum secret sharing schemes for general access 
structures, these schemes are not claimed to be efficient. In this context the present results prove 
to be useful; they enable us to construct efficient quantum secret sharing schemes for many general 
access structures. More precisely, we show that an identically self-dual matroid that is representable 
over a finite field induces a pure state quantum secret sharing scheme with information rate one. 
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I. INTRODUCTION 

Secret sharing is an important cryptographic primi- 
tive originally motivated by the need to distribute se- 
cure information among parties some of whom are un- 
trustworthy 0, [2^ . Additionally, it finds applications in 
secure multi-party distributed computation 0, 0. Se- 
cret sharing schemes have a rich mathematical struc- 
ture [1^ and they have been shown to be closely as- 
sociated to error correc ting codes [1, [13, and ma- 
troids P, i, [i, [13, m, ill. The interplay with these 
objects has enabled us to obtain new insights not only 
about secret sharing schemes but codes and matroids as 
well. Although relatively new, the field of quantum secret 
sharing Il3| has made rapid progress both theoreti cally 
00,li!l,lll, [11,113,1311 and experimentally 0, [H, [13, [M ■ 
However, its connections with other mathematical disci- 
plines have not been as well studied. In particular, no 
connections have been made with the theory of matroids, 
which is in sharp contrast to the classical scenario. These 
connections are of more than theoretical interest. Classi- 
cally, optimal secret sharing schemes i.e. those with infor- 
mation rate one. are induced by matroids. Additionally, 
matroids provide alternate methods to prove bounds on 
the rates that can be achieved for certain access struc- 
tures. For all these reasons it is useful to develop the 
theory of matroids and quantum secret sharing schemes. 

In this paper it is our goal to bring into bearing the the- 
ory of matroids to characterize quantum secret sharing 
schemes. While our results are only the first steps toward 
this characterization, they do indicate the usefulness of 
such associations. This paper is organized as follows. We 
begin with a brief review of the necessary background in 
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secret sharing. In Section|TT]we review some of the known 
results on classical secret sharing schemes and matroids; 
these results are not well known in the quantum informa- 
tion community and also provide the backdrop for gen- 
eralizing the connections between matroids and secret 
sharing schemes. In Section IIIII we prove the central re- 
sult of this paper, namely how representable identically 
self-dual matroids lead to efficient quantum secret shar- 
ing schemes. We assume that the reader is familiar with 
the basic results on quantum computing and stabilizer 
codes. 



A. Classical secret sharing 

A secret sharing scheme is a protocol to distribute a 
secret s among a set of players P, by a dealer D, such 
that only authorized subsets of P can reconstruct the se- 
cret. Subsets of P which cannot reconstruct the secret 
arc called unauthorized sets. The access structure T con- 
sists of all subsets that can reconstruct the secret. The 
adversary structure A consists of all unauthorized sub- 
sets. Any access structure T is required to satisfy the 
monotone property i.e. if A e F, then any set B A 
is also in F. This is the only restriction on the access 
structures for classical secret sharing schemes. Any ac- 
cess structure satisfying the monotone property can be 
realized by an appropriate secret sharing scheme albeit 
with large complexity, see for instance [13] ■ A secret shar- 
ing scheme is said to be perfect if the unauthorized sets 
cannot extract any information about the secret. A pre- 
cise information theoretic formulation can be given that 
quantifies this condition. We typically require the secret 
to be taken from a finite alphabet, S. The shares dis- 
tributed need not be in the same domain as the secret; 
in fact each share can be in a domain of different alpha- 
bet. Let the domain of the ith party be S^. An important 
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metric of performance for secret sharing schemes is the 
information rate p which is defined as 



p = mm 



dimS 
dim §i 



(1) 



Secret sharing schemes with p — 1 are said to be ideaL 
The associated access structure is said to be ideaL More 
generaUy if an access structure can be reahzcd with in- 
formation rate one for some secret sharing scheme, then 
it is said to be ideal Note that we do not restrict the 
dimension of the secret in this case. An important prob- 
lem of secret sharing is to construct ideal secret sharing 
schemes for any given (monotone) access structure. Not 
every access structure can be realized with information 
rate of one. 



B. Quantum secret sharing 

A quantum secret sharing scheme generalizes the clas- 
sical one in two possible ways. We use quantum states to 
share either a secret quantum state or a classical secret. 
Some authors refer to the first case as quantum state 
sharing, reserving the term "quantum secret sharing" to 
situations where the secret is shared in an adversarial 
setting. Though this might be preferable in some con- 
texts, wc will continue to use the traditional terminology. 
Quantum secret sharing schemes for classical secrets were 
introduced by Hillery et al in [l^. They also proposed 
schemes for sharing quantum secrets, however these are 
not perfect i.e., unauthorized sets can extract some in- 
formation about the secret. Cleve et al Q proposed the 
first perfect quantum secret sharing schemes for quantum 
secrets. The theory of quantum secret sharing was devel- 
oped further making important connections to quantum 
coding theory in and quantum information theory 
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states in 0. 

In this paper we are concerned with the sharing of 
quantum secrets. Unlike classical secret sharing schemes 
a quantum secret sharing scheme cannot realize every 
monotone access structure. An additional constraint due 
to the "no-cloning theorem" [1, [s^] has to be imposed on 
a realizable access structure. Recall that the no-cloning 
theorem states that an arbitrary quantum state cannot 
be copied. In any quantum secret sharing scheme we 
cannot have two disjoint authorized sets in the access 
structure as this would violate the no-cloning theorem. 
This condition in conjunction with the monotonicity of 
access structure determines the allowed access structures 
for all quantum secret sharing schemes [ll|, Theorem 8] . 
The same condition has been stated in different forms in 
the literature. We record this result in its various forms 
for future use. First we need the notion of dual of a set. 
Let P be a set, then we denote the powerset of P as 2^. 
For any subset A C 2^, we define the dual of A as 



Lemma 1 (Self-orthogonal access structures). Let F he 

the access structure and A the adversary structure of 
a quantum secret sharing scheme. Then the following 
statements are equivalent. 



Ar\B for all A,B gT 
F C F* 
A* CA 



(3) 
(4) 
(5) 



Proof We shall show that @ ^ (3). It follows that if 
A er, then_ A ^ F as A n = 0. But F* = {P | B ^ 
F}. Since A ^ F it follows that A e F* and F C F*. 
Conversely, let F C F* . Then from the definition of F* , 
it follows that for any A £ F, we must have A ^ T i.e. 
A G A. Further all subsets of A are also in A. Now 
assume that there exists some _B G F such that AOB = 0. 
Then B C A. But all subsets oi A A i.e. they are not 
in F which contradicts that B €T. Therefore there exists 
no subset B £ T such that An B ^ $ proving that (g]) 

Now we shall show that (g]) 4^ dS]). Assume that (g]) 
holds. Then since F n ^ = and F U = 2^ = F* U 
we have that = (F* U ^*) \ F = (F* \ F) U yt*, where 
we used the fact that F* n ^* =0 and F C F*. It now 
follows that A* A and (O holds. Now assume that 
([5|) holds, then again we have T \J A = T* U A* and this 
time we can write F* = (F U ^) \ A* = (F* \ F) U yi* and 
therefore F* D F and ^ holds. □ 

We often refer to an access structure that is realizable 
by a quantum secret sharing scheme as a quantum access 
structure. Smith [13, Theorem 1] characterized the ad- 
versary structure of quantum secret sharing schemes as 
in ([5]). Condition ([4]) is somewhat reminiscent of the re- 
quirement for self-orthogonal classical codes for quantum 
error correction. If F = F* , then we say that the access 
structure is self-dual. 

A quantum secret sharing scheme which encodes a pure 
state secret into a global pure state is said to be a pure 
state scheme and a mixed state scheme if it encodes into 
a global mixed state. Self dual access structures can be 
realized by pure state schemes, where as non-self-dual 
access structures can be realized only as mixed state 
schemes. A theorem [ill. Theorem 3] due to Gottesman 
shows that every mixed state scheme can be derived from 
a pure state scheme. So we do not lose any generality by 
focussing on the pure state schemes. The simplest access 
structures are the {{k, n)) threshold access structures — in 
this case, the authorized sets are any subset of size > k 
and unauthorized sets are subsets of cardinality less than 
k. Smith [23 and independently Gottesman [ll| showed 
how to construct quantum secret sharing schemes with 
general access structures. 

In studying general access structures it is often conve- 
nient to work with the minimal access structures, which 
are the generating sets of the access structures. We define 
the minimal access structure F„i of the access structure 
F as 



A* = {x C P \x ^ A}. 



(2) 



{A G F I P ^ A for any 5 e F}. 



(6) 
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If every party in P occurs in at least one minimal au- 
thorized set of r, then we say that the access structure 
is connected. We restrict our attention to such access 
structures in this paper. Our primary goal in this pa- 
per is to explore connections of quantum secret sharing 
schemes with matroids and characterizing the associated 
access structures in terms of matroids if it is possible. We 
also address the construction of secret sharing schemes. 
Our constructions make use of CSS codes reminiscent of 
the constructions of Smith for general access structures. 



interested in finite fields. We can also define matroids in 
terms of their bases, which are maximal independent sets 
of V. A set V and B C 2^ form a matroid MiV,B) if 
and only if the following conditions hold. 
Bl) B^iJ). 

B2) li Bi,B2 e B such that x e Bi \ B2., then there 

exists a y & B2 \ Bl such that (Bi \ a;) U {y} S B. 
Given a matroid j\4{V,B) we define its dual matroid 
Ai{V,B)* as the matroid with ground set V and bases 
B* ^{V\B\BeB} i.e. M{V, B)* = M{V, B*). 



II. MATROIDS AND SECRET SHARING 

Matroids have been associated to secret sharing 
schemes [1, Q , also see [l^ for a brief overview of some of 
the main results. Such schemes which are induced by a 
matroid are called matroidal. Useful results with respect 
to characterization and performance of secret sharing 
schemes can be derived by means of such an association, 
P, Q. Also, such an association also implies an implicit 
correspondence between matroids and access structures. 
In fact, classically, most of the associations focus on this 
correspondence and tend to ignore the scheme realizing 
the access structure. By far we do same however, since 
a given access structure might not be a quantum access 
structure we do bear in mind that we cannot entirely ig- 
nore the fact that the access structure is being realized 
through a quantum scheme. It is important to note that 
not every secret sharing scheme can be associated to a 
matroid. 



A. Matroids 

First we recall a few facts about matroids, readers in- 
terested in a comprehensive introduction to matroids can 
refer to [U. 

A set V and C C 2^ form a matroid M{V,C) if and 
only if the following conditions hold. For any A, B ^ C 
andAy^B 
Ml) A%B. 

M2) If a; £ An B, then there exists a C £ C such that 

CC {AUB)\{x}. 
We say that V is the ground set and C the set of circuits 
of the matroid. A proper subset of any circuit is said to 
be independent while a set containing any circuit is said 
to be dependent. With every matroid we define a non- 
negative integer valued function called the rank function 
rk : 1/ -> N as 

rk(X) = |J|, (7) 

where / C X C y is a maximal independent subset of 
X. A matroid is said to be (linearly) representable over a 
field F if the ground set can be identified with the columns 
of a matrix (over F) and the circuits with the minimal de- 
pendent columns of the matrix. In this paper we are only 



B. Secret sharing schemes from matroids 

Given a matroid Ai we can associate a secret sharing 
scheme to Ai{V,C). We assume that the ground set of the 
matroid is given by ^ = {0, 1, . . . , n — 1, n}. We identify 
one of the elements of the ground set, say i G V, as the 
dealer and then list all the circuits of A4 that contain i. 
Let this be denoted as 

r,,m = {C\cuieC}. (8) 

Gonsider the access structure given by 

r, = {A I y D A D C for some C G F,,™}. (9) 

We can easily verify that F^ is a monotonic and that 
its minimal access structure is given by Ti^m- Since any 
monotonic access structure can be realized as a secret 
sharing scheme every matroid defines an access structure. 
This result is stated in the following fact, see 

Fact 1. Every matroid A4(V,C) induces an access struc- 
ture Ti as defined in equation ([9]). 

Please note that the above association is in a sense 
nonconstructive, it does not specify how to derive the 
associated secret sharing scheme; it merely states that 
there exists a secret sharing scheme that can realize the 
induced access structure F^. Further, depending on which 
element of the ground set of the matroid is identified as 
the dealer, we may obtain many schemes with possibly 
different access structures from the same matroid. 

A natural question that we are faced with is how to 
make this association constructive and determine the 
bounds on the information rate of the resulting access 
structure. Brickell and Davenport [3| showed that if the 
matroid is representable over a finite field [s^ . then we 
obtain ideal secret sharing schemes and access structures. 

However, if the matroid is not representable, then we 
can no longer be certain if the matroid induces an ideal 
secret sharing scheme. Seymour proved that there exist 
non-representable matroids which cannot induce an ideal 
secret sharing scheme [l^] , while Simonis and Ashikhmin 
[2^ showed that there exist non-representable matroids, 
such as the non-Pappus matroid, which induce ideal 
schemes. However, these latter matroids — while not af- 
fording a linear representation — can be multilinearly rep- 
resented. Matroids which induce ideal access structures 
are called ss- representable matroids [l^. They may not 
be linearly representable. 
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C. Matroids from secret sharing schemes 

Given that we can obtain secret sharing schemes from 
matroids, we could ask if the converse is possible. As we 
mentioned earlier, such a correspondence does not exist 
for all secret sharing schemes. We review some of the re- 
lated work in this context. The correspondence between 
the matroids and secret sharing schemes naturally im- 
plies that the access structure is associated to the circuits 
of the matroid. This association could involve the scheme 
explicitly. However a result due to Martin [l^, see also 
[28l | , shows that we can associate the access structure to a 
matroid independently of the scheme used to realize that 
structure. This involves a function, say /, defined on the 
space of access structures; / maps an access structure to 
an ordered pair, which may or may not be a matroid. If 
/(r) is a matroid, then we say that F is matroid-related. 
The minimal access structure will play a more important 
role in this regard. As usual we denote by P the set of 
participants and by D the dealer. Define the extended 
access structure Fg = {AUD \ for all A G F„j}. Further 
let 

I(A,B) ^ AuB\(r) C] (10) 

n _ \ minimal sets of J(A, S) for 1 , , 
"^^ ^ \ all A, B G r„ and A 7^ B / ' ^ > 

We let /(F) ^{P\JD, Cr). If Cr satisfies the axioms Ml 
and M2, then we associate F to the matroid A^r whose 
ground set is P U D and the set of circuits are given by 
Cr i.e. 

Mr = M{PyjDXr). (12) 

This definition of the matroid is in terms of the cir- 
cuits that can be formed from the ground set. We could 
always define a structure from the secret sharing scheme, 
equivalently its access structure, as above but the result- 
ing structure is not necessarily a matroid. It is a matroid 
only under certain conditions. Only when (P U D,Ct) 
induce a matroid we say that F is matroid related. 

Classically an access structure induces a matroid only 
when it satisfies certain conditions. Before we can state 
this condition precisely we need the notion of minors. Let 
F be an access structure, then we define two operations 
of deletion and contraction, which we denote by "\" and 
"/" respectively. Given a set Z C P wc define 

T\Z = {ACP\Z\AeT}, (13) 

T/z = {AC p\z \ All z er}. (i4) 

An access structure F' derived from F through a sequence 
of deletions and contractions is called a minor of F. A 
result by Seymour [2^ shows that the access structures 
are matroid related if the access structure satisfies a for- 
bidden minor relation. 

Lemma 2 (Seymour). An access structure F C 2^ is 
matroid related if and only if it does not have the follow- 
ing minors: 



a. Fa = {{l,2},{2,3},{3,4}} 

b. Ffc = {l,2},{l,3},{l,4},{2,3}} 

c. F, = {{1,2},{1,3},{2,3,4}} 

d. Fd = {{l,...,s},{l,s+l},...,{s,.s + l}} 

where P ~ {1, . . . , 4} except in d where P = {1, . . . s, s -I- 
1} and s > 3. 

Please note that in the preceding result, the mini- 
mal access structures are given rather than the complete 
access structure. Seymour originally stated this result 
in terms of matroid ports. The reformulation we have 
given here in terms of the access structures is due to 
Marti- Farre and Padro [l^. This result together with 
Lemma [T] immediately provides us with a criterion as to 
which quantum access structures can be induced by ma- 
troids. 

Self-orthogonality, however, is not a property inher- 
ited by minors of access structures. For instance con- 
traction docs not always preserve the self-orthogonality 
of the access structures. Consider the following (mini- 
mal) access structure: F = {{1, 2, 3}, {2, 3, 4}, {3, 4, 5}}. 
Then F/3 = {{1, 2}, {2, 4}, {4, 5}}. In this case we have 
two disjoint authorized sets; such an access structure 
cannot be realized by a quantum secret sharing scheme 
as it would lead to a violation of the no cloning theo- 
rem. Therefore, it is not possible to determine a result 
similar to Lemma [5] for self-orthogonal access structures 
i.e. the forbidden minors for access structures that are 
self-orthogonal. Incidentally, there exist other important 
classes of matroids such as transversal matroids which 
are not minor closed. 

Brickcll and Davenport 0, Theorem 1] showed that ev- 
ery classical ideal access structure induces a matroid. In 
figures [T] and [2] we summarize the relation between per- 
missible access structures, matroidal access structures, 
and ideal access structures for classical schemes and 
quantum schemes. We do not know if every access struc- 
ture that is realized by an ideal quantum secret sharing 
scheme induces a matroid. Therefore we show that the 
set of ideal quantum access structures does not lie en- 
tirely in the set of matroidal access structures in figured 



III. RELATING MATROIDS AND QUANTUM 
SECRET SHARING 

A. Matroidal quantum secret sharing schemes 

In this section we present the central result of our pa- 
per. Theorem m It shows that a class of matroids induce 
ideal pure state quantum secret sharing schemes. First 
we need the following preliminaries. We say a matroid is 
self-dual if it is isomorphic to its dual matroid. If it is 
equal to its dual matroid then we say it is an identically 
self-dual (ISD) matroid. 
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Classical access structures 




FIG. 1: Relation between ideal, matroidal and general classi- 
cal access structures 



Quantum access structures 




FIG. 2: Relation between ideal, matroidal and general quan- 
tum access structures. It is possible that all ideal quantum 
access structures are also matroidal. 



Fact 2. LetT, andVf be the access structures induced by 
a matroid M{V,C) and its dual matroid A4* by treating 
the ith element as the dealer. Then we have 



r 



(15) 



Fact [5] was stated in [y]. Together with Lemma [H 
and the fact that every self-dual access structure can be 
realized as a pure state scheme [TTI . Theorem 8] , it implies 
the following result, stated explicitly due to its relevance 
for us. 

Corollary 3. An identically self-dual matroid M. in- 
duces a pure state quantum secret sharing scheme. 

However, the preceding result does not give us a 
method to construct a quantum secret sharing scheme 
from the matroid, neither does it tell us if the scheme is 
ideal. The following theorem gives the general procedure 
to transform a representable identically self-dual matroid 
into a quantum secret sharing scheme. We denote a finite 
field with q elements as F^. Following standard notation, 
we use [n,k^d\q to denote a classical code over and 
[[n, fc, d]]q to denote a quantum code over F^. If C is a 
code, we denote a generator matrix of C by Gc ■ The code 



obtained by deleting the ith coordinate of C is called a 
punctured code of C and denoted as Pi(C). Suppose we 
consider the subcode of C with the zth coordinate zero, 
then the code obtained by puncturing the zth coordinate 
of the subcode is called a shortening of C and denoted 
as (Ti(C). We have the following useful relations between 
the punctured and shortened codes and their duals. 



a,(C) C p,{C) and a,{C)^ = p,{C^). 



(16) 



If X G then we denote the support of x as supp(x) = 
{i I Xi ^ 0}. A codeword x in C is said to be a mini- 
mal support if there exists no nonzero codeword y in C 
such that supp(?;) C supp(a;). If in addition its leftmost 
nonzero component is 1, then it is said to be a mini- 
mal codeword. Minimal codewords were introduced by 
Massey . They facilitate the study of classical secret 
sharing schemes, especially in characterizing the access 
structures. 

Theorem 4. Let M{V,C) be an identically self-dual ma- 
troid representable over a finite field Fg, where V = 
{0,1,..., 71 — l,n}. Suppose that C C F^"*"^ such that 
the generator matrix of C is a representation of Ai . Let 



Gc 



' 1 
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Gao(C) _ 



idG 



Po(C) 



9 

GaaiC) 



(17) 



Then there exists an ideal pure state quantum secret shar- 
ing scheme S on P ~ {l,...,n} whose access struc- 
ture Tq and minimal access structure Fo^m; a'^G defined 
by equations ^ and ([5]) respectively. The encoding for 
S is determined by the stabilizer code with the stabilizer 
matrix given by 



GaoiC) 








GpoiC)^ _ 



(18) 



The reconstruction procedure for an authorized set A is 
the transformation on S such that the encoded operators 
for the transformed stabilizer code are Xi = X (S) 
and Zi = 

Proof. The proof of this theorem is structured as follows. 
Since S relies on the encoding of the stabilizer code de- 
rived from S, we first show that S defines a stabilizer 
code and identify certain properties of the codes C and 
essential to recovering the secret. Then we show that 
if the secrets are encoded using the stabilizer encoding, 
then an element A G Fo.m does correspond to a mini- 
mal authorized set by explicitly reconstructing the secret 
with the shares in A and proving that no proper subset 
of A can reconstruct the secret. 

Encoding the secret: We can easily check that the matrix 
given in equation pB]) does define a stabilizer code. We 
see that cro(C) is an [n,k — l,d]q code, while poiC) is 
an [n,k,d — l]q code with cro(C') C Po{C). Therefore 
we have po{C)-^ C (To(C)"'- ensuring the orthogonality of 
ao{C) and po{C)'^ in equation ([T5)l . The dimension of S 
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is given byfc — 1 + n — fc = i 
[[n, 1, d']]q quantum code, Q. 

Since A4{V,C) is an identically self-dual matroid, both 
C and C-"- represent M{V,C). Therefore, g ^ 0, oth- 
erwise the zeroth column would be all zero in which 
would mean that {0} is a circuit, while from C, we would 
conclude that {0} is independent and not a circuit; a con- 
tradiction. Furthermore, without loss of generality we 
can choose {l\g) to be a minimal codeword c in C [33| . 

As the support of a minimal codeword in C is a cir- 
cuit of M{V,C), it follows that there exists a minimal 
codeword c' in C*^ such that supp(c') = supp(c), in 
particular there exists a vector {(3\(3g') £ such that 
supp(/3g') — supp(g) for some /3 S and g' E pq{C^). 

The mapping for the secret sharing scheme is given as 
follows: 



1. Thus S defines an In other words, there exists a linear combination of the 



E 

a:e<To(C) 



s ■ g + x), where s G Fg 



(19) 



Encoding of an arbitrary secret state follows by linearity 
of the encoding map. The encoded X operator for the 
quantum code is given hy X = ^f^iX^', or equivalently 
[ g I ] , its representation over F^" . 

Recovering the secret: Let A G Fo^m, then A U {0} G 
C and there exists a minimal codeword c' G such 
that supp(c') = ^ U {0}. Let c' be a minimal codeword 
in C"*- such that Cq = 1. We know that there exists a 
c G C such that supp(c) = supp(c'). We can choose 
Co = 1 since C is a linear code. Then, we have po{c) ^ 
ao{C). Then both po{c) and g are in the same coset of 
ao{C) in po{C). This holds because the cosets of tTo(C) 
in po (C) are in one to one correspondence with the cosets 
of [0|(7o(C)] in C. The various coset representatives are 
given by (a\ag), a G ¥q. Two coset representatives r, r' 
represent the same coset if and only if rg = r'o- Therefore 
all the minimal codewords c, with cq = 1 are in the same 
coset as {l\g)- From this follows that po{c) is in the same 
coset as (g). Therefore, the state |s) might as well be 
given by 



\s) E \s-Pq{c) + x). 



(20) 



Denote the columns of G'o-o(c) by Si, where 1 < i < n. 
Since c' G C^, we have 



Gcic'Y 



1 Ci C2 . 

Si .. 



The above equation can also be written as 



Cl C2 . . . c„ 
Sl ... Sr, 



columns of G„^i^c) such that 

i6supp(po(c')) 



(21) 



Now let us rewrite the stabilizer and the encoded X op- 
erator as follows. 



s 



Poic') 









GaoiC) 












GpoiC)^ _ 






Cl • • • 


Cl ••• 

















ri ■■■ Tn 



where, without loss of generality, we can assume that 
Po(c') and therefore po(c) have support in the first I 
columns only, i.e., c,; ^ for 1 < i < Z, and that Ci = 
for i > I, where 1 < / < n. Note that I > 1 because we 
must have c-c' = and I ~ implies that (1|0) • (1|0) = 
which is clearly not possible. 

Let us transform the first column of S as per equa- 
tion dHI) i.e., Sl ^ Eiesupp(po(c')) ^'i^i- Then we obtain 



1 


C2 • 


■ Cl ■ 


• 








S2 






















ri 7=2 • 


■ n ''(+1 • 





Therein, the columns r2 to r/ arc transformed in the Z- 
part while only the first column is transformed in the X- 
part. For binary schemes this involves only CNOT gates, 
for nonbinary schemes, we have to use the generalized 
CNOT gates [l^l- Now let us transform the encoded X 
operator to the trivial operator given by Xi . This gives 
us 



1 










^2 • 


• Sl Sl+l ■ 


















h ■ 


■ n n+i • 





which is in the form 



1 





Sx 








Sz 



The column fi has to become zero because the stabilizer 
must commute with the encoded X operator now given 
by Xi . The encoded secret has now been transformed as 



E 



s X = s 



E I-) 



As can be seen above, the secret is completely disen- 
tangled from the rest of the qubits. Furthermore, in all 
these transformations we operated only on the qudits in 
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the support of the minimal codeword. Thus the elements 
of Fo.m are authorized sets. 

Minimality of Fo.m- The sets in Fo^m are minimal autho- 
rized sets because a proper subset of supp(c') is not in C 
and all operators with their support in supp(c') must lie 
outside C{S), the centralizer of S. Such operators cannot 
extract any information about the encoded state as they 
correspond to detectable errors of the stabihzer code. 
Completeness of Tq: By Fact ^ the access structure 
Fq is self-dual, therefore |Fo| = 2""-'^. But the comple- 
ment of everyone of these authorized sets is unauthorized 
set otherwise we would violate the no-cloning theorem. 
Together these sets exhaust all the possible subsets of 
{1, . . . , n}. Thus there are no more authorized sets out- 
side the ones given in Fq and the quantum access struc- 
ture is completely defined by Fq. 

Finally, the purity of E follows from the explicit encoding 
procedure given. That S is ideal follows from the fact 
that each share has the same dimension as the secret. □ 

We note that the choice of which element in the ma- 
troid is identified with the dealer is arbitrary. In The- 
orem m for simplicity we have assumed that the first 
element is the dealer. Further, we need the representa- 
tion of the matroid before we can use it to construct the 
scheme. It is still open if every identically self-dual ma- 
troid can be realized as a self-dual code, @. However, 
every self-dual code induces a identically self-dual ma- 
troid. Consequently, we have the following corollary that 
gives us many efficient pure state quantum secret sharing 
schemes. 



Corollary 5. Let C QW^ he an 

that = C with generator matrix Gc given as 



l,k,(£\q code such 



Gc = 



1 
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and G 



Po(C) 



G 



cro(C) 



(22) 



Then there exists an ideal pure state quantum secret shar- 
ing scheme T, on n parties whose minimal access struc- 
ture is 



supp(c) \ {0} 



c is a minimal codeword 
of C with cq = 1 



The encoding for S is determined by the stabilizer code 
with the stabilizer matrix given by 



(23) 



s = 












'^Po(C)^ _ 


The encoding for a 


state \s) , where s 


\s). 


- E 


\s- g + x) 







(24) 



The reconstruction procedure for an authorized set A of 
E is the transformation on S such that the encoded op- 
erators for the transformed stabilizer are Xi and Z\ . 



B. An example 

We now give an example to illustrate the construction. 
Let us consider the extended Hamming code given by the 
following generator matrix. 





" 1 


1 


1 


1 


1— ' 


1 


1 


1 " 







1 











1 


1 


1 
























1 





1 





1 


1 













1 


1 


1 


1 


0_ 



We can check that C is self-dual. The punctured code 
Pq{C) and the shortened code cro(C') are given by the 
following generator matrices. (For clarity we show only 
nonzero entries). 



G 



Po(C) 



1111111 



G, 



<To(C) 



1 1 1 1 

10 10 11 

11110 

1 1 1 1 
10 10 11 
11110 



Now let us form a (CSS) stabilizer code with stabilizer 
matrix as follows. 



S = 














' 1 











1 


1 


1 



















1 





1 





1 


1 























1 


1 


1 


1 

































1 











1 


1 


1 




















1 





1 





1 


1 






















1 


1 


1 


1 


0. 



For this stabilizer code the encoding for |0) and |1) is 
given as follows: 



|0) 



10000000) 
11101100) 

llllllll) 

10010011) 



llOOOlll) 
11011001) 
10111000) 
10100110) 



10101011) 
10110101) 
11010100) 
11001010) 

i ■ X 



10011110) 
IlllOOlO) 
11100001) 
10001101) 



Observe that \s) t-^ J2cea-a{C} k ■ ^ + c), where X is 
in <To(G)^ \ (To(G). Now consider a minimal codeword 
c in G^ such that co = 1. One such codeword is 
c = (1, 1, 1, 0, 0, 0, 0, 1). Observe that (1, 1, 0, 0, 0, 0, 1|0) 
i.e. X1X2X'! is an encoded operator for the stabilizer 
code. The support of c is given by {0, 1, 2, 7}. The lin- 
ear combination of the columns in the support of Pq{c) 
gives us (1, 0, 0, 0)*. If we computed the linear combina- 
tion of the columns 1,2,7 into the first column we get 
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the following action on stabilizer of the code. 
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1 


1 



















1 





1 
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1 























1 


1 


1 


1 
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1 








1 


1 























1 





1 





1 


1 






















1 


1 


1 


1 


0. 



The encoded operator (1, 1, 0, 0, 0, 0, 1|0) maps to 
(1, 1, 0, 0, 0, 0, 1|0). If we now transform the encoded 
operator to (1, 0, 0, 0, 0, 0, 0|O) the stabilizer gets further 
transformed as 
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1 


1 



















1 





1 
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1 
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1 


1 


1 




































1 
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1 























1 





1 
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1 






















1 


1 


1 


1 


0. 



Observe that this time only the Z part of the stabilizer 
is transformed. Now the encoded secret is in the state 

|s) (1000000) + 1000111) + IIOIOII) + 1011110) 
+ llOllOO) + 1011001) + IllOlOl) + IllOOlO)) 

The secret is completely disentangled from the rest of the 
shares. Therefore, supp(c) \ {0} forms an authorized set. 
The rest of the shares cannot reconstruct or extract any 
information from their shares because of the no-cloning 
theorem. Similarly any minimal codeword in C"*" with 
Co = 1 defines an authorized set for the scheme. Suppose 
that c is a minimal codeword with cq = 0, then it must 
be in ao{C) and any other vector whose support is the 



same must be in S or outside C{S), the centralizer of 
S. No such operator can reveal any information about 
the encoded secret since they are detectable errors of the 
stabilizer code and by definition detectable errors reveal 
nothing about the encoded information. 

C. Discussion 

The results in this section have important benefits. 
Quantum secret sharing schemes for general access struc- 
tures were proposed by Gottesman jll| and Smith [27t . 
based on monotone span programs. These constructions 
are not optimal in general. Our method gives optimal 
schemes with information rate one. However, not every 
ideal quantum secret sharing scheme can be derived by 
Theorem m For instance, the ((3,5)) threshold scheme 
can be realized using the [[5,1,3]] quantum code, but 
it cannot be realized by the method proposed. Further- 
more, the access structure of the ((3, 5)) scheme induces a 
matroid. It would be worth investigating to find out how 
such quantum schemes can derived from matroids. An- 
other interesting question would be to derive ideal quan- 
tum secret sharing schemes from non-represcntablc ISD 
matroids. 
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